0

After I read about prepared statement,I can set prepared statement like following. It worked, but I haven't understood what is the merit of prepared statment. because I wonder what is the merit beyond normal sql in prepared statment ?

SELECT CONCAT("SELECT *
"FROM table",
"Where snapshot_day >= cast(now() as date) - interval 9 day ",
"And type in ('Daily') ",
"GROUP BY 1") INTO @myquery;
SELECT @myquery;
PREPARE stmt FROM @myquery;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

If someone has opinion, please let me know

LukStorms
  • 28,916
  • 5
  • 31
  • 45
Heisenberg
  • 4,787
  • 9
  • 47
  • 76
  • That might depend on the use case, but as the given example does not contain any user-supplied content, this might not be a security topic – Nico Haase Jan 14 '22 at 07:54
  • 1
    *what is the merit of prepared statment.* Some parts of SQL query cannot be parametrized (for example, tablenames) - only dynamic SQL allows to execute such queries. An example of the real task - expand all VARCHAR columns lengths in all database tables till VARCHAR(255)... – Akina Jan 14 '22 at 07:54

0 Answers0